Eusig Bundle Laravel Package

Technical Evaluation

Architecture Fit

• Symfony Alignment: The bundle is tightly integrated with Symfony’s DI, Config, and Kernel, making it a natural fit for Symfony-based applications (v6.4+). For Laravel, this requires adaptation (e.g., manual service registration, config parsing, or a Symfony-compatible facade layer).
• eIDAS Compliance: Leverages the underlying authentin/eusig library, which abstracts EU DSS (Digital Signature Service) protocols. This ensures regulatory compliance for legally binding signatures in EU markets.
• Modular Design: The bundle exposes interfaces (SignerInterface, ValidatorInterface) and autowired services, enabling dependency injection and mocking for testing. Laravel’s service container can replicate this pattern with minor adjustments.

Integration Feasibility

• Core Dependencies:
  • PSR-18 HTTP Client: Laravel’s built-in Http client (or Guzzle) satisfies this.
  • PSR-17 Factories: Laravel’s Psr17Factory or similar can be used.
  • EU DSS Backend: Requires a running EU DSS instance (Docker-compatible), which must be hosted externally or containerized in the Laravel stack.
• Configuration Overhead:
  • Symfony’s YAML config must be mapped to Laravel’s .env + config files (e.g., config/eusig.php).
  • PKCS12 token management (for signing) requires secure storage (e.g., Laravel’s filesystem or a dedicated HSM integration).

Technical Risk

Key Questions

1. Compliance Requirements:
   • Does the application need full eIDAS compliance, or is a subset (e.g., PAdES) sufficient?
   • Are there specific signature levels (e.g., PAdES_BASELINE_LT, XAdES) required by stakeholders?
2. Infrastructure:
   • Will EU DSS run on-premise, in a container, or via a third-party API?
   • What are the latency/SLA requirements for signature operations?
3. Security:
   • How will PKCS12 keystores be managed (e.g., encrypted storage, HSM, or cloud KMS)?
   • Are there audit logs required for signature operations?
4. Performance:
   • What is the expected volume of signatures (e.g., 100/day vs. 10,000/day)? Scaling may require EU DSS clustering.
5. Fallbacks:
   • Should the system support offline signing or alternative providers (e.g., DocuSign) if EU DSS fails?

Integration Approach

Stack Fit

• Laravel Compatibility:
  • Symfony → Laravel Mapping:

    Symfony Component	Laravel Equivalent
    Symfony\Config	config/eusig.php (manual parsing)
    Symfony\DependencyInjection	Laravel’s Service Provider + bind()
    Symfony\HttpClient	Laravel’s Http client or Guzzle

  • Recommended Approach: Create a Laravel service provider to register interfaces and bind implementations (e.g., SignerInterface to a custom EusigSigner class).
• Dependency Injection:
  • Use Laravel’s container to autowire SignerInterface, ValidatorInterface, etc., similar to Symfony’s autowiring.
  • Example:

    // app/Providers/EusigServiceProvider.php
    public function register()
    {
        $this->app->bind(SignerInterface::class, function ($app) {
            return new EusigSigner(
                $app->make(SigningClientInterface::class),
                $app->make(TokenInterface::class)
            );
        });
    }
    

Migration Path

1. Phase 1: Proof of Concept (PoC)
   • Install authentin/eusig (standalone) and test PDF signing/validation without the bundle.
   • Verify EU DSS connectivity using the Docker image.
   • Example PoC code:

     use Authentin\Eusig\Client\DssSigningClient;
     use Authentin\Eusig\Model\Document;
     
     $client = new DssSigningClient('http://dss:8080/services/rest');
     $document = Document::fromLocalFile('contract.pdf');
     $signed = $client->sign($document, new SignatureParameters());
     

2. Phase 2: Bundle Adaptation
   • Create a Laravel-compatible facade for eusig-bundle services.
   • Example facade:

     // app/Facades/Eusig.php
     public static function signer(): SignerInterface {
         return app(SignerInterface::class);
     }
     

3. Phase 3: Full Integration
   • Replace PoC code with autowired services (e.g., inject SignerInterface into controllers).
   • Configure Laravel’s config/eusig.php to mirror Symfony’s YAML:

     return [
         'dss' => [
             'base_url' => env('DSS_BASE_URL'),
         ],
         'token' => [
             'type' => 'pkcs12',
             'path' => env('PKCS12_PATH'),
             'password' => env('PKCS12_PASSWORD'),
         ],
     ];
     

Compatibility

• PHP Version: Requires PHP 8.2+ (Laravel 10+ supports this).
• Laravel Version: Tested with Laravel 10/11 (Symfony 6.4/7.0/8.0 compatibility).
• EU DSS Version: Bundle assumes EU DSS 5.x+. Check for API changes if using an older version.
• PDF Libraries: Ensure ext-imagick or ext-gd is installed for PDF processing.

Sequencing

1. Prerequisites:
   • Set up EU DSS (Docker or cloud instance).
   • Configure PKCS12 keystore (generate via OpenSSL if needed).
2. Core Integration:
   • Install dependencies (authentin/eusig, symfony/http-client, nyholm/psr7).
   • Create Laravel service provider and config.
3. Testing:
   • Test signing/validation with mock EU DSS (e.g., WireMock).
   • Validate edge cases (e.g., large PDFs, network timeouts).
4. Deployment:
   • Containerize EU DSS if not using Docker directly.
   • Secure keystore credentials (e.g., Laravel Vault or AWS Secrets Manager).
5. Monitoring:
   • Log signature operations (e.g., Laravel’s events or a dedicated queue).
   • Set up alerts for EU DSS downtime.

Operational Impact

Maintenance

• Bundle Updates:
  • Monitor authentin/eusig-bundle for breaking changes (e.g., EU DSS API updates).
  • Dependency Locking: Pin versions in composer.json to avoid surprises.
• Configuration Drift:
  • Centralize EU DSS config in Laravel’s .env to avoid hardcoding.
  • Use Laravel’s config caching (php artisan config:cache) for performance.
• Keystore Rotation:
  • Implement a keystore renewal process (e.g., cron job to check expiry dates).
  • Store old keystores securely for audit purposes.

Support

• Troubleshooting:
  • Common Issues:
    • EU DSS connectivity errors → Check DSS_BASE_URL and network policies.
    • PKCS12 errors → Verify PKCS12_PATH and password.
    • PDF corruption → Ensure PHP extensions (imagick, ghostscript) are installed.
  • Debugging Tools:
    • Enable EU DSS logging (dss.log in container).
    • Use Laravel’s tap() or dd() to inspect Document objects before signing.
• Vendor Support:
  • authentin/eusig has limited community support (7 stars, MIT license). Plan for self-hosted EU DSS maintenance.

Scaling

• Horizontal Scaling:
  • EU